CVE-2026-82462

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82462

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82462.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82462

Published

2026-08-29T16:35:26.177Z

Modified

2026-08-31T03:45:58.883924708Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

Details

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82462.json",
    "cwe_ids": [
        "CWE-345"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/pac4j/pac4j

Affected ranges

Type

GIT

Repo

https://github.com/pac4j/pac4j

Events

Introduced

Fixed

0ce4586f0526cb94d1e2bb6623c416db9b4dc2a3

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.5.6"
        }
    ]
}

Affected versions

6.*

6.0.4.1

pac4j-1.*

pac4j-1.4.0

pac4j-1.4.1

pac4j-1.5.0

pac4j-1.5.1

pac4j-1.6.0

pac4j-1.6.0-RC1

pac4j-1.7.0

pac4j-1.8.0

pac4j-1.8.0-RC1

pac4j-1.8.1

pac4j-1.8.2

pac4j-1.8.3

pac4j-1.9.0

pac4j-1.9.1

pac4j-1.9.2

pac4j-1.9.3

pac4j-2.*

pac4j-2.0.0

pac4j-2.0.0-RC1

pac4j-2.0.0-RC2

pac4j-2.1.0

pac4j-3.*

pac4j-3.0.0

pac4j-3.0.0-RC1

pac4j-3.0.0-RC2

pac4j-3.0.1

pac4j-3.1.0

pac4j-3.2.0

pac4j-3.3.0

pac4j-3.4.0

pac4j-4.*

pac4j-4.0.0

pac4j-4.0.0-RC1

pac4j-4.0.0-RC2

pac4j-4.0.0-RC3

pac4j-4.0.1

pac4j-4.0.2

pac4j-4.0.3

pac4j-4.1.0

pac4j-5.*

pac4j-5.0.0

pac4j-5.0.0-RC1

pac4j-5.0.0-RC2

pac4j-5.0.1

pac4j-5.1.0

pac4j-5.1.1

pac4j-5.1.2

pac4j-5.1.3

pac4j-5.1.4

pac4j-5.1.5

pac4j-parent-5.*

pac4j-parent-5.2.0

pac4j-parent-5.2.1

pac4j-parent-5.3.0

pac4j-parent-5.3.1

pac4j-parent-5.4.0

pac4j-parent-5.4.2

pac4j-parent-5.4.3

pac4j-parent-5.4.4

pac4j-parent-5.4.5

pac4j-parent-5.4.6

pac4j-parent-5.5.0

pac4j-parent-5.6.0

pac4j-parent-5.6.1

pac4j-parent-5.7.0

pac4j-parent-6.*

pac4j-parent-6.0.0

pac4j-parent-6.0.0-RC1

pac4j-parent-6.0.0-RC10

pac4j-parent-6.0.0-RC2

pac4j-parent-6.0.0-RC3

pac4j-parent-6.0.0-RC4

pac4j-parent-6.0.0-RC5

pac4j-parent-6.0.0-RC6

pac4j-parent-6.0.0-RC7

pac4j-parent-6.0.0-RC8

pac4j-parent-6.0.0-RC9

pac4j-parent-6.0.1

pac4j-parent-6.0.2

pac4j-parent-6.0.3

pac4j-parent-6.0.4

pac4j-parent-6.0.5

pac4j-parent-6.0.6

pac4j-parent-6.1.0

pac4j-parent-6.1.1

pac4j-parent-6.1.2

pac4j-parent-6.1.3

pac4j-parent-6.2.0

pac4j-parent-6.2.1

pac4j-parent-6.2.2

pac4j-parent-6.3.0

pac4j-parent-6.3.1

pac4j-parent-6.3.2

pac4j-parent-6.4.0

pac4j-parent-6.4.0-RC1

pac4j-parent-6.4.1

pac4j-parent-6.5.0

pac4j-parent-6.5.1

pac4j-parent-6.5.2

pac4j-parent-6.5.3

pac4j-parent-6.5.4

pac4j-parent-6.5.5

scribe-up-1.*

scribe-up-1.0.0

scribe-up-1.1.0

scribe-up-1.3.0

scribe-up-1.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82462.json"